Set Up Single Sign-On for SAML 1.x and WS-Federation

4-22 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation Fill in the Required Attributes for WS-Federation SSO Take these steps to achieve this task: 1. On the Federations page, select the WS-Fed 1.1 provider and click Edit.

2. Select the option to Update Manually.

3. Select the Peer Provider Settings tab.

4. If the peer provider is an identity provider: a. In the Identity Provider Authority Settings section enter the peer provider’s signing certificate, in New Signature Verification Certificate field.

b. In the Identity Realm Secure Token URL field, add the URL of the peer

provider to which the authentication request should be sent. 5. If the peer provider is a service provider:

a. In the Resource Realm Secure Token URL field, enter the URL of the peer

provider to which the assertion should be sent. b. From the Assertion TypeVersion drop-down list, select the version of the assertion that should be sent to this service provider. Required Properties to Send to Peer Provider - WS-Federation As IdP needs to send to peer provider SP ■ ProviderID https:server_name:server_portfedidp ■ Signing Certificate ■ Identity Realm Secure Token URL The URL to which authentication requests should be sent https:server_name:server_ port fedidpwsfed11 As SP, needs to send to peer provider IdP ■ ProviderID https:server_name:server_portfedsp ■ Resource Realm Secure Token URL The URL to which assertions should be sent https:server_name:server_portfedspwsfed11 ■ Assertion TypeVersion The version of the assertion to be sent; optional Required Properties to Send to Peer Provider - SAML 1.x The IdP needs to send to peer provider SP ■ ProviderID https:server_name:server_portfedidp ■ Signing Certificate ■ IdP initiate SSO URL the URL to which authentication requests should be sent For SAML 1.1: https:server_name:server_portfedidpsamlv11sso For SAML 1.0: https:server_name:server_portfedidpsamlv10sso ■ IdP Artifact resolution URL URL for sending artifact query https:server_name:server_portfedidpsoapv11 Server Administration 4-23 ■ Target URL query parameter for Oracle Identity Federation it is TARGET. The parameter contains the URL on which the user lands after a successful sign-on. ■ ProviderID URL query parameter for Oracle Identity Federation it is providerid. The parameter contains the SP providerID when SP initiates a SAML1.x SSO ■ SourceID required for the artifact profile. The value is obtained from the IdP metadata, from tag saml1md:SourceID As SP, needs to send to peer provider IdP: ■ ProviderID https:server_name:server_portfedsp ■ Signing Certificate if signing SOAP requests ■ Assertion Consumer URL The URL to which assertions should be sent https:server_name:server_portfedspsamlv11sso

4.4 Configuring Identities

Use this page to locate and manage user and federated identities, and to maintain search options. ■ About Federated Identities ■ Identities - Federations ■ Identities - Users ■ Identities - Search Options

4.4.1 About Federated Identities

When a user performs SSO for the first time, and Oracle Identity Federation is configured with a federation data store, it creates a federation record for the user containing information about the federated identity. This includes: ■ the Username – the User ID with which Oracle Identity Federation identifies the user. ■ the User description – the user description ■ the IdP Provided Name ID – the Name ID provided by the identity provider when SSO was performed ■ the IdP Provided Name ID Format – the format of the Name ID provided by the identity provider. This field will be empty if the format is persisent. ■ the IdP Provided Name ID Qualifier - the Name ID qualifier, optionally provided by the identity provider. ■ the Protocol Version – the protocol version used when performing SSO. ■ the SP Provided Name ID – the Name ID provided by the service provider. This will be blank when the federation is created. ■ the SP Provided Name ID Format – the format of the Name ID provided by the service provider. This field will be empty if the format is persisent. ■ the SP Provided Name ID Qualifier – the Name ID qualifier, optionally provided by the service provider. Note: Liberty 1.x support is deprecated.